1From d298b41f90cbf1f2e5a10e29daa1fc92ddee52c9 Mon Sep 17 00:00:00 2001
2From: Javier Martinez Canillas <javierm@redhat.com>
3Date: Wed, 14 Oct 2020 16:33:42 +0200
4Subject: [PATCH] mmap: Don't register cutmem and badram commands when lockdown
5 is enforced
6
7The cutmem and badram commands can be used to remove EFI memory regions
8and potentially disable the UEFI Secure Boot. Prevent the commands to be
9registered if the GRUB is locked down.
10
11Fixes: CVE-2020-27779
12
13Reported-by: Teddy Reed <teddy.reed@gmail.com>
14Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
15Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
16Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
17---
18 docs/grub.texi        |  4 ++++
19 grub-core/mmap/mmap.c | 13 +++++++------
20 2 files changed, 11 insertions(+), 6 deletions(-)
21
22diff --git a/docs/grub.texi b/docs/grub.texi
23index 98592d3..f2fe149 100644
24--- a/docs/grub.texi
25+++ b/docs/grub.texi
26@@ -4051,6 +4051,10 @@ this page is to be filtered.  This syntax makes it easy to represent patterns
27 that are often result of memory damage, due to physical distribution of memory
28 cells.
29
30+Note: The command is not allowed when lockdown is enforced (@pxref{Lockdown}).
31+      This prevents removing EFI memory regions to potentially subvert the
32+      security mechanisms provided by the UEFI secure boot.
33+
34 @node blocklist
35 @subsection blocklist
36
37diff --git a/grub-core/mmap/mmap.c b/grub-core/mmap/mmap.c
38index 57b4e9a..7ebf32e 100644
39--- a/grub-core/mmap/mmap.c
40+++ b/grub-core/mmap/mmap.c
41@@ -20,6 +20,7 @@
42 #include <grub/memory.h>
43 #include <grub/machine/memory.h>
44 #include <grub/err.h>
45+#include <grub/lockdown.h>
46 #include <grub/misc.h>
47 #include <grub/mm.h>
48 #include <grub/command.h>
49@@ -534,12 +535,12 @@ static grub_command_t cmd, cmd_cut;
50
51 GRUB_MOD_INIT(mmap)
52 {
53-  cmd = grub_register_command ("badram", grub_cmd_badram,
54-			       N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
55-			       N_("Declare memory regions as faulty (badram)."));
56-  cmd_cut = grub_register_command ("cutmem", grub_cmd_cutmem,
57-				   N_("FROM[K|M|G] TO[K|M|G]"),
58-				   N_("Remove any memory regions in specified range."));
59+  cmd = grub_register_command_lockdown ("badram", grub_cmd_badram,
60+                                        N_("ADDR1,MASK1[,ADDR2,MASK2[,...]]"),
61+                                        N_("Declare memory regions as faulty (badram)."));
62+  cmd_cut = grub_register_command_lockdown ("cutmem", grub_cmd_cutmem,
63+                                            N_("FROM[K|M|G] TO[K|M|G]"),
64+                                            N_("Remove any memory regions in specified range."));
65
66 }
67
68--
692.14.2
70
71